Keylogger Help

[ResidentBiscuit]

Don't worry! It's not for malicious purposes, just for my person learning. I want to create a key logger that will act as a service, so no window will appear. Also I would like it to send a file of the keys entered once a day to an email. I also want this file to be as hard to find as possible (ie a hidden file). The format I would like the file to be is:

Window name/page name
Keys entered...
Keys entered...
Keys entered...

Window name/page name
Keys entered...
Keys entered...
Keys entered...

Window name/page name
Keys entered...
Keys entered...
Keys entered...

etc...


So basically, I'm not sure what tools I should use for this. Can I do it all in a console application and just hide the console window? I realize I will need to use one of the transfer protocols for sending it to an email, but I don't know which one (I don't know much about programming with a network at all). So, any and all advice is welcome! But, please don't just give me the code. I want to write it all myself. Just having trouble with starting it.

[webJose]

You want to run it as a service, so learn about Windows services: http://msdn.microsoft.com/en-us/library/ms681921(VS.85).aspx

You want it to log keys, so learn about setting up a keyboard hook: http://msdn.microsoft.com/en-us/library/windows/desktop/ms644984(v=vs.85).aspx

You want to write a log file, so learn about file I/O: http://www.cplusplus.com/doc/tutorial/files/

You'll also need to learn how to send email and a few other things, but I believe you have enough for now with the above three.

[Stewbond]

Here's an earlier post with the same question. Check out their solution:
http://cplusplus.com/forum/beginner/57570/

[ResidentBiscuit]

Cool thanks everyone, now I have a starting point.

[modoran]

You cannot interact with the desktop from a service running as LOCAL SYSTEM due to session isolation security (there is a workaround to this) and you can't access the network except from network account.

[ResidentBiscuit]

You cannot interact with the desktop from a service running as LOCAL SYSTEM due to session isolation security (there is a workaround to this) and you can't access the network except from network account.

What do you mean?

[modoran]

It means you cannot display even a banal message box, you cannot spawn another GUI process, you cannot access HKEY_CURRENT_USER registry hive, etc from a windows service in windows vista or later.
Microsoft called this feature "session 0 isolation".
http://msdn.microsoft.com/en-us/library/bb756986.aspx

[ResidentBiscuit]

So, are you saying what I'm trying to accomplish is impossible?

[modoran]

There is a workaround to launch a process in user desktop from a windows service, explained here: (I used myself in the past for another purpose)
http://www.codeproject.com/KB/vista-security/VistaSessions.aspx

You need another exe which load the DLL which load keyboard hook. The exe will run with administrative privileges, allowing you to catch keystrokes sent to elevated applications, which is not normally possible.

If you run in 64-bit mode you need 2 exe and 2 DLLs, apart from the service itself. A 32-bit DLL cannot be injected in a 64-bit process.